1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2
 
2
 
 
 
 
2
 
2
 
2
2
2
 
 
 
 
1
 
 
 
 
 
 
2
 
 
 
2
 
 
 
2
 
2
 
 
 
 
 
 
 
1
2
 
 
 
 
 
2
 
 
2
 
 
2
2
 
1
 
 
 
2
 
 
1
1
1
 
1
1
 
 
1
1
 
1
 
 
1
 
2
 
 
 
 
 
1
 
1
 
1
 
 
 
 
1
2
2
3
3
3
3
1
 
 
3
3
 
 
 
 
3
 
 
 
1
3
1
 
 
 
1
1
 
 
 
 
 
 
 
1
 
1
1
1
 
1
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
1
 
 
 
 
 
 
 
 
 
 
 
1
 
 
6
6
 
1
 
2
 
1
 
2
 
 
 
 
1
1
 
1
 
 
 
 
1
 
 
 
 
 
 
1
 
 
1
1
 
 
1
1
 
1
1
1
1
1
1
1
 
1
1
 
1
 
 
 
 
/*
example.js
 
quickstart example
 
instruction
    1. save this script as example.js
    2. run the shell command:
        $ npm install npmtest-sinopia && PORT=8081 node example.js
    3. play with the browser-demo on http://127.0.0.1:8081
*/
 
 
 
/* istanbul instrument in package npmtest_sinopia */
/*jslint
    bitwise: true,
    browser: true,
    maxerr: 8,
    maxlen: 96,
    node: true,
    nomen: true,
    regexp: true,
    stupid: true
*/
(function () {
    'use strict';
    var local;
 
 
 
    // run shared js-env code - init-before
    (function () {
        // init local
        local = {};
        // init modeJs
        local.modeJs = (function () {
            try {
                return typeof navigator.userAgent === 'string' &&
                    typeof document.querySelector('body') === 'object' &&
                    typeof XMLHttpRequest.prototype.open === 'function' &&
                    'browser';
            } catch (errorCaughtBrowser) {
                return module.exports &&
                    typeof process.versions.node === 'string' &&
                    typeof require('http').createServer === 'function' &&
                    'node';
            }
        }());
        // init global
        local.global = local.modeJs === 'browser'
            ? window
            : global;
        // init utility2_rollup
        local = local.global.utility2_rollup || (local.modeJs === 'browser'
            ? local.global.utility2_npmtest_sinopia
            : global.utility2_moduleExports);
        // export local
        local.global.local = local;
    }());
    switch (local.modeJs) {
 
 
 
    // init-after
    // run browser js-env code - init-after
    /* istanbul ignore next */
    case 'browser':
        local.testRunBrowser = function (event) {
            Eif (!event || (event &&
                    event.currentTarget &&
                    event.currentTarget.className &&
                    event.currentTarget.className.includes &&
                    event.currentTarget.className.includes('onreset'))) {
                // reset output
                Array.from(
                    document.querySelectorAll('body > .resettable')
                ).forEach(function (element) {
                    switch (element.tagName) {
                    case 'INPUT':
                    case 'TEXTAREA':
                        element.value = '';
                        break;
                    default:
                        element.textContent = '';
                    }
                });
            }
            switch (event && event.currentTarget && event.currentTarget.id) {
            case 'testRunButton1':
                // show tests
                Eif (document.querySelector('#testReportDiv1').style.display === 'none') {
                    document.querySelector('#testReportDiv1').style.display = 'block';
                    document.querySelector('#testRunButton1').textContent =
                        'hide internal test';
                    local.modeTest = true;
                    local.testRunDefault(local);
                // hide tests
                } else {
                    document.querySelector('#testReportDiv1').style.display = 'none';
                    document.querySelector('#testRunButton1').textContent = 'run internal test';
                }
                break;
            // custom-case
            default:
                break;
            }
            Iif (document.querySelector('#inputTextareaEval1') && (!event || (event &&
                    event.currentTarget &&
                    event.currentTarget.className &&
                    event.currentTarget.className.includes &&
                    event.currentTarget.className.includes('oneval')))) {
                // try to eval input-code
                try {
                    /*jslint evil: true*/
                    eval(document.querySelector('#inputTextareaEval1').value);
                } catch (errorCaught) {
                    console.error(errorCaught);
                }
            }
        };
        // log stderr and stdout to #outputTextareaStdout1
        ['error', 'log'].forEach(function (key) {
            console[key + '_original'] = console[key];
            console[key] = function () {
                var element;
                console[key + '_original'].apply(console, arguments);
                element = document.querySelector('#outputTextareaStdout1');
                Iif (!element) {
                    return;
                }
                // append text to #outputTextareaStdout1
                element.value += Array.from(arguments).map(function (arg) {
                    return typeof arg === 'string'
                        ? arg
                        : JSON.stringify(arg, null, 4);
                }).join(' ') + '\n';
                // scroll textarea to bottom
                element.scrollTop = element.scrollHeight;
            };
        });
        // init event-handling
        ['change', 'click', 'keyup'].forEach(function (event) {
            Array.from(document.querySelectorAll('.on' + event)).forEach(function (element) {
                element.addEventListener(event, local.testRunBrowser);
            });
        });
        // run tests
        local.testRunBrowser();
        break;
 
 
 
    // run node js-env code - init-after
    /* istanbul ignore next */
    case 'node':
        // export local
        module.exports = local;
        // require modules
        local.fs = require('fs');
        local.http = require('http');
        local.url = require('url');
        // init assets
        local.assetsDict = local.assetsDict || {};
        /* jslint-ignore-begin */
        local.assetsDict['/assets.index.template.html'] = '\
<!doctype html>\n\
<html lang="en">\n\
<head>\n\
<meta charset="UTF-8">\n\
<meta name="viewport" content="width=device-width, initial-scale=1">\n\
<title>{{env.npm_package_name}} (v{{env.npm_package_version}})</title>\n\
<style>\n\
/*csslint\n\
    box-sizing: false,\n\
    universal-selector: false\n\
*/\n\
* {\n\
    box-sizing: border-box;\n\
}\n\
body {\n\
    background: #dde;\n\
    font-family: Arial, Helvetica, sans-serif;\n\
    margin: 2rem;\n\
}\n\
body > * {\n\
    margin-bottom: 1rem;\n\
}\n\
.utility2FooterDiv {\n\
    margin-top: 20px;\n\
    text-align: center;\n\
}\n\
</style>\n\
<style>\n\
/*csslint\n\
*/\n\
textarea {\n\
    font-family: monospace;\n\
    height: 10rem;\n\
    width: 100%;\n\
}\n\
textarea[readonly] {\n\
    background: #ddd;\n\
}\n\
</style>\n\
</head>\n\
<body>\n\
<!-- utility2-comment\n\
<div id="ajaxProgressDiv1" style="background: #d00; height: 2px; left: 0; margin: 0; padding: 0; position: fixed; top: 0; transition: background 0.5s, width 1.5s; width: 25%;"></div>\n\
utility2-comment -->\n\
<h1>\n\
<!-- utility2-comment\n\
    <a\n\
        {{#if env.npm_package_homepage}}\n\
        href="{{env.npm_package_homepage}}"\n\
        {{/if env.npm_package_homepage}}\n\
        target="_blank"\n\
    >\n\
utility2-comment -->\n\
        {{env.npm_package_name}} (v{{env.npm_package_version}})\n\
<!-- utility2-comment\n\
    </a>\n\
utility2-comment -->\n\
</h1>\n\
<h3>{{env.npm_package_description}}</h3>\n\
<!-- utility2-comment\n\
<h4><a download href="assets.app.js">download standalone app</a></h4>\n\
<button class="onclick onreset" id="testRunButton1">run internal test</button><br>\n\
<div id="testReportDiv1" style="display: none;"></div>\n\
utility2-comment -->\n\
\n\
\n\
\n\
<label>stderr and stdout</label>\n\
<textarea class="resettable" id="outputTextareaStdout1" readonly></textarea>\n\
<!-- utility2-comment\n\
{{#if isRollup}}\n\
<script src="assets.app.js"></script>\n\
{{#unless isRollup}}\n\
utility2-comment -->\n\
<script src="assets.utility2.rollup.js"></script>\n\
<script src="jsonp.utility2._stateInit?callback=window.utility2._stateInit"></script>\n\
<script src="assets.npmtest_sinopia.rollup.js"></script>\n\
<script src="assets.example.js"></script>\n\
<script src="assets.test.js"></script>\n\
<!-- utility2-comment\n\
{{/if isRollup}}\n\
utility2-comment -->\n\
<div class="utility2FooterDiv">\n\
    [ this app was created with\n\
    <a href="https://github.com/kaizhu256/node-utility2" target="_blank">utility2</a>\n\
    ]\n\
</div>\n\
</body>\n\
</html>\n\
';
        /* jslint-ignore-end */
        Iif (local.templateRender) {
            local.assetsDict['/'] = local.templateRender(
                local.assetsDict['/assets.index.template.html'],
                {
                    env: local.objectSetDefault(local.env, {
                        npm_package_description: 'the greatest app in the world!',
                        npm_package_name: 'my-app',
                        npm_package_nameAlias: 'my_app',
                        npm_package_version: '0.0.1'
                    })
                }
            );
        } else {
            local.assetsDict['/'] = local.assetsDict['/assets.index.template.html']
                .replace((/\{\{env\.(\w+?)\}\}/g), function (match0, match1) {
                    // jslint-hack
                    String(match0);
                    switch (match1) {
                    case 'npm_package_description':
                        return 'the greatest app in the world!';
                    case 'npm_package_name':
                        return 'my-app';
                    case 'npm_package_nameAlias':
                        return 'my_app';
                    case 'npm_package_version':
                        return '0.0.1';
                    }
                });
        }
        // run the cli
        Eif (local.global.utility2_rollup || module !== require.main) {
            break;
        }
        local.assetsDict['/assets.example.js'] =
            local.assetsDict['/assets.example.js'] ||
            local.fs.readFileSync(__filename, 'utf8');
        // bug-workaround - long $npm_package_buildCustomOrg
        /* jslint-ignore-begin */
        local.assetsDict['/assets.npmtest_sinopia.rollup.js'] =
            local.assetsDict['/assets.npmtest_sinopia.rollup.js'] ||
            local.fs.readFileSync(
                local.npmtest_sinopia.__dirname + '/lib.npmtest_sinopia.js',
                'utf8'
            ).replace((/^#!/), '//');
        /* jslint-ignore-end */
        local.assetsDict['/favicon.ico'] = local.assetsDict['/favicon.ico'] || '';
        // if $npm_config_timeout_exit exists,
        // then exit this process after $npm_config_timeout_exit ms
        if (Number(process.env.npm_config_timeout_exit)) {
            setTimeout(process.exit, Number(process.env.npm_config_timeout_exit));
        }
        // start server
        if (local.global.utility2_serverHttp1) {
            break;
        }
        process.env.PORT = process.env.PORT || '8081';
        console.error('server starting on port ' + process.env.PORT);
        local.http.createServer(function (request, response) {
            request.urlParsed = local.url.parse(request.url);
            if (local.assetsDict[request.urlParsed.pathname] !== undefined) {
                response.end(local.assetsDict[request.urlParsed.pathname]);
                return;
            }
            response.statusCode = 404;
            response.end();
        }).listen(process.env.PORT);
        break;
    }
}());
 
 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
 
 
 
 
 
 
 
 
 
 
 
2
 
2
 
 
 
 
2
 
2
 
2
2
2
 
 
 
 
1
 
 
 
 
 
 
2
 
 
 
2
 
2
 
2
1
 
1
1
1
 
 
 
 
 
/* istanbul instrument in package npmtest_sinopia */
/*jslint
    bitwise: true,
    browser: true,
    maxerr: 8,
    maxlen: 96,
    node: true,
    nomen: true,
    regexp: true,
    stupid: true
*/
(function () {
    'use strict';
    var local;
 
 
 
    // run shared js-env code - init-before
    (function () {
        // init local
        local = {};
        // init modeJs
        local.modeJs = (function () {
            try {
                return typeof navigator.userAgent === 'string' &&
                    typeof document.querySelector('body') === 'object' &&
                    typeof XMLHttpRequest.prototype.open === 'function' &&
                    'browser';
            } catch (errorCaughtBrowser) {
                return module.exports &&
                    typeof process.versions.node === 'string' &&
                    typeof require('http').createServer === 'function' &&
                    'node';
            }
        }());
        // init global
        local.global = local.modeJs === 'browser'
            ? window
            : global;
        // init utility2_rollup
        local = local.global.utility2_rollup || local;
        // init lib
        local.local = local.npmtest_sinopia = local;
        // init exports
        if (local.modeJs === 'browser') {
            local.global.utility2_npmtest_sinopia = local;
        } else {
            module.exports = local;
            module.exports.__dirname = __dirname;
            module.exports.module = module;
        }
    }());
}());
 
 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
 
 
 
 
 
 
 
 
 
 
 
2
 
2
 
 
 
 
2
 
2
 
2
2
2
 
 
 
 
1
 
 
 
 
 
 
2
 
 
2
 
 
1
 
 
 
1
 
 
1
 
1
 
 
2
 
 
 
 
 
2
2
 
2
 
 
 
 
 
1
 
 
 
 
 
1
 
 
 
 
 
2
2
 
2
 
 
 
 
 
1
 
 
 
 
 
 
1
 
 
 
1
 
 
1
 
 
 
 
 
 
1
 
 
 
 
 
 
1
1
 
 
1
 
 
 
 
 
 
1
1
1
1
1
1
 
 
1
 
 
 
 
2
2
 
 
1
 
 
 
 
 
 
2
2
 
 
1
 
 
 
 
 
 
2
2
 
 
1
 
 
 
 
 
 
2
2
 
 
1
 
 
 
 
 
 
1
1
 
 
 
1
1
 
 
 
 
/* istanbul instrument in package npmtest_sinopia */
/*jslint
    bitwise: true,
    browser: true,
    maxerr: 8,
    maxlen: 96,
    node: true,
    nomen: true,
    regexp: true,
    stupid: true
*/
(function () {
    'use strict';
    var local;
 
 
 
    // run shared js-env code - init-before
    (function () {
        // init local
        local = {};
        // init modeJs
        local.modeJs = (function () {
            try {
                return typeof navigator.userAgent === 'string' &&
                    typeof document.querySelector('body') === 'object' &&
                    typeof XMLHttpRequest.prototype.open === 'function' &&
                    'browser';
            } catch (errorCaughtBrowser) {
                return module.exports &&
                    typeof process.versions.node === 'string' &&
                    typeof require('http').createServer === 'function' &&
                    'node';
            }
        }());
        // init global
        local.global = local.modeJs === 'browser'
            ? window
            : global;
        switch (local.modeJs) {
        // re-init local from window.local
        case 'browser':
            local = local.global.utility2.objectSetDefault(
                local.global.utility2_rollup || local.global.local,
                local.global.utility2
            );
            break;
        // re-init local from example.js
        case 'node':
            local = (local.global.utility2_rollup || require('utility2'))
                .requireReadme();
            break;
        }
        // export local
        local.global.local = local;
    }());
 
 
 
    // run shared js-env code - function
    (function () {
        return;
    }());
    switch (local.modeJs) {
 
 
 
    // run browser js-env code - function
    case 'browser':
        break;
 
 
 
    // run node js-env code - function
    case 'node':
        break;
    }
 
 
 
    // run shared js-env code - init-after
    (function () {
        return;
    }());
    switch (local.modeJs) {
 
 
 
    // run browser js-env code - init-after
    case 'browser':
        local.testCase_browser_nullCase = local.testCase_browser_nullCase || function (
            options,
            onError
        ) {
        /*
         * this function will test browsers's null-case handling-behavior-behavior
         */
            onError(null, options);
        };
 
        // run tests
        local.nop(local.modeTest &&
            document.querySelector('#testRunButton1') &&
            document.querySelector('#testRunButton1').click());
        break;
 
 
 
    // run node js-env code - init-after
    /* istanbul ignore next */
    case 'node':
        local.testCase_buildApidoc_default = local.testCase_buildApidoc_default || function (
            options,
            onError
        ) {
        /*
         * this function will test buildApidoc's default handling-behavior-behavior
         */
            options = { modulePathList: module.paths };
            local.buildApidoc(options, onError);
        };
 
        local.testCase_buildApp_default = local.testCase_buildApp_default || function (
            options,
            onError
        ) {
        /*
         * this function will test buildApp's default handling-behavior-behavior
         */
            local.testCase_buildReadme_default(options, local.onErrorThrow);
            local.testCase_buildLib_default(options, local.onErrorThrow);
            local.testCase_buildTest_default(options, local.onErrorThrow);
            local.testCase_buildCustomOrg_default(options, local.onErrorThrow);
            options = [];
            local.buildApp(options, onError);
        };
 
        local.testCase_buildCustomOrg_default = local.testCase_buildCustomOrg_default ||
            function (options, onError) {
            /*
             * this function will test buildCustomOrg's default handling-behavior
             */
                options = {};
                local.buildCustomOrg(options, onError);
            };
 
        local.testCase_buildLib_default = local.testCase_buildLib_default || function (
            options,
            onError
        ) {
        /*
         * this function will test buildLib's default handling-behavior
         */
            options = {};
            local.buildLib(options, onError);
        };
 
        local.testCase_buildReadme_default = local.testCase_buildReadme_default || function (
            options,
            onError
        ) {
        /*
         * this function will test buildReadme's default handling-behavior-behavior
         */
            options = {};
            local.buildReadme(options, onError);
        };
 
        local.testCase_buildTest_default = local.testCase_buildTest_default || function (
            options,
            onError
        ) {
        /*
         * this function will test buildTest's default handling-behavior
         */
            options = {};
            local.buildTest(options, onError);
        };
 
        local.testCase_webpage_default = local.testCase_webpage_default || function (
            options,
            onError
        ) {
        /*
         * this function will test webpage's default handling-behavior
         */
            options = { modeCoverageMerge: true, url: local.serverLocalHost + '?modeTest=1' };
            local.browserTest(options, onError);
        };
 
        // run test-server
        local.testRunServer(local);
        break;
    }
}());
 
 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
module.exports = function(grunt) {
  grunt.initConfig({
    pkg: grunt.file.readYAML('package.yaml'),
    browserify: {
      dist: {
        files: {
          'lib/static/main.js': [ 'lib/GUI/js/main.js' ]
        },
        options: {
          debug: true,
          transform: [ 'browserify-handlebars' ]
        }
      }
    },
    less: {
      dist: {
        files: {
          'lib/static/main.css': [ 'lib/GUI/css/main.less' ]
        },
        options: {
          sourceMap: false
        }
      }
    },
    watch: {
      files: [ 'lib/GUI/**/*' ],
      tasks: [ 'default' ]
    }
  })
 
  grunt.loadNpmTasks('grunt-browserify')
  grunt.loadNpmTasks('grunt-contrib-watch')
  grunt.loadNpmTasks('grunt-contrib-less')
 
  grunt.registerTask('default', [
    'browserify',
    'less'
  ])
}
 
 

1
2
3
4
5
6
7
8
9
10
11
12
1
1
 
 
 
 
 
 
 
 
 
 
require('es6-shim')
module.exports = require('./lib')
 
/**package
{ "name": "sinopia",
  "version": "0.0.0",
  "dependencies": {"js-yaml": "*"},
  "scripts": {"postinstall": "js-yaml package.yaml > package.json ; npm install"}
}
**/
 
 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
1
1
1
1
1
 
1
 
1
1
1
1
1
 
1
 
 
 
 
1
 
 
 
 
 
 
 
1
1
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
2
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
1
1
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
1
1
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
var Crypto       = require('crypto')
var jju          = require('jju')
var Error        = require('http-errors')
var Logger       = require('./logger')
var load_plugins = require('./plugin-loader').load_plugins
 
module.exports = Auth
 
function Auth(config) {
  var self = Object.create(Auth.prototype)
  self.config = config
  self.logger = Logger.logger.child({ sub: 'auth' })
  self.secret = config.secret
 
  var plugin_params = {
    config: config,
    logger: self.logger
  }
 
  Iif (config.users_file) {
    if (!config.auth || !config.auth.htpasswd) {
      // b/w compat
      config.auth = config.auth || {}
      config.auth.htpasswd = { file: config.users_file }
    }
  }
 
  self.plugins = load_plugins(config, config.auth, plugin_params, function (p) {
    return p.authenticate || p.allow_access || p.allow_publish
  })
 
  self.plugins.unshift({
    sinopia_version: '1.1.0',
 
    authenticate: function(user, password, cb) {
      if (config.users != null
       && config.users[user] != null
       && (Crypto.createHash('sha1').update(password).digest('hex')
            === config.users[user].password)
      ) {
        return cb(null, [ user ])
      }
 
      return cb()
    },
 
    adduser: function(user, password, cb) {
      if (config.users && config.users[user])
        return cb( Error[403]('this user already exists') )
 
      return cb()
    },
  })
 
  function allow_action(action) {
    return function(user, package, cb) {
      var ok = package[action].reduce(function(prev, curr) {
        if (user.groups.indexOf(curr) !== -1) return true
        return prev
      }, false)
 
      if (ok) return cb(null, true)
 
      if (user.name) {
        cb( Error[403]('user ' + user.name + ' is not allowed to ' + action + ' package ' + package.name) )
      } else {
        cb( Error[403]('unregistered users are not allowed to ' + action + ' package ' + package.name) )
      }
    }
  }
 
  self.plugins.push({
    authenticate: function(user, password, cb) {
      return cb( Error[403]('bad username/password, access denied') )
    },
 
    add_user: function(user, password, cb) {
      return cb( Error[409]('registration is disabled') )
    },
 
    allow_access: allow_action('access'),
    allow_publish: allow_action('publish'),
  })
 
  return self
}
 
Auth.prototype.authenticate = function(user, password, cb) {
  var plugins = this.plugins.slice(0)
 
  ;(function next() {
    var p = plugins.shift()
 
    if (typeof(p.authenticate) !== 'function') {
      return next()
    }
 
    p.authenticate(user, password, function(err, groups) {
      if (err) return cb(err)
      if (groups != null && groups != false)
        return cb(err, AuthenticatedUser(user, groups))
      next()
    })
  })()
}
 
Auth.prototype.add_user = function(user, password, cb) {
  var self = this
  var plugins = this.plugins.slice(0)
 
  ;(function next() {
    var p = plugins.shift()
    var n = 'adduser'
    if (typeof(p[n]) !== 'function') {
      n = 'add_user'
    }
    if (typeof(p[n]) !== 'function') {
      next()
    } else {
      p[n](user, password, function(err, ok) {
        if (err) return cb(err)
        if (ok) return self.authenticate(user, password, cb)
        next()
      })
    }
  })()
}
 
Auth.prototype.allow_access = function(package_name, user, callback) {
  var plugins = this.plugins.slice(0)
  var package = Object.assign({ name: package_name },
                              this.config.get_package_spec(package_name))
 
  ;(function next() {
    var p = plugins.shift()
 
    if (typeof(p.allow_access) !== 'function') {
      return next()
    }
 
    p.allow_access(user, package, function(err, ok) {
      if (err) return callback(err)
      if (ok) return callback(null, ok)
      next() // cb(null, false) causes next plugin to roll
    })
  })()
}
 
Auth.prototype.allow_publish = function(package_name, user, callback) {
  var plugins = this.plugins.slice(0)
  var package = Object.assign({ name: package_name },
                              this.config.get_package_spec(package_name))
 
  ;(function next() {
    var p = plugins.shift()
 
    if (typeof(p.allow_publish) !== 'function') {
      return next()
    }
 
    p.allow_publish(user, package, function(err, ok) {
      if (err) return callback(err)
      if (ok) return callback(null, ok)
      next() // cb(null, false) causes next plugin to roll
    })
  })()
}
 
Auth.prototype.basic_middleware = function() {
  var self = this
  return function(req, res, _next) {
    req.pause()
    function next(err) {
      req.resume()
      // uncomment this to reject users with bad auth headers
      //return _next.apply(null, arguments)
 
      // swallow error, user remains unauthorized
      // set remoteUserError to indicate that user was attempting authentication
      if (err) req.remote_user.error = err.message
      return _next()
    }
 
    if (req.remote_user != null && req.remote_user.name !== undefined)
      return next()
    req.remote_user = AnonymousUser()
 
    var authorization = req.headers.authorization
    if (authorization == null) return next()
 
    var parts = authorization.split(' ')
 
    if (parts.length !== 2)
      return next( Error[400]('bad authorization header') )
 
    var scheme = parts[0]
    if (scheme === 'Basic') {
      var credentials = Buffer(parts[1], 'base64').toString()
    } else if (scheme === 'Bearer') {
      var credentials = self.aes_decrypt(Buffer(parts[1], 'base64')).toString('utf8')
      if (!credentials) return next()
    } else {
      return next()
    }
 
    var index = credentials.indexOf(':')
    if (index < 0) return next()
 
    var user = credentials.slice(0, index)
    var pass = credentials.slice(index + 1)
 
    self.authenticate(user, pass, function(err, user) {
      if (!err) {
        req.remote_user = user
        next()
      } else {
        req.remote_user = AnonymousUser()
        next(err)
      }
    })
  }
}
 
Auth.prototype.bearer_middleware = function() {
  var self = this
  return function(req, res, _next) {
    req.pause()
    function next(_err) {
      req.resume()
      return _next.apply(null, arguments)
    }
 
    if (req.remote_user != null && req.remote_user.name !== undefined)
      return next()
    req.remote_user = AnonymousUser()
 
    var authorization = req.headers.authorization
    if (authorization == null) return next()
 
    var parts = authorization.split(' ')
 
    if (parts.length !== 2)
      return next( Error[400]('bad authorization header') )
 
    var scheme = parts[0]
    var token = parts[1]
 
    if (scheme !== 'Bearer')
      return next()
 
    try {
      var user = self.decode_token(token)
    } catch(err) {
      return next(err)
    }
 
    req.remote_user = AuthenticatedUser(user.u, user.g)
    req.remote_user.token = token
    next()
  }
}
 
Auth.prototype.cookie_middleware = function() {
  var self = this
  return function(req, res, _next) {
    req.pause()
    function next(_err) {
      req.resume()
      return _next()
    }
 
    if (req.remote_user != null && req.remote_user.name !== undefined)
      return next()
 
    req.remote_user = AnonymousUser()
 
    var token = req.cookies.get('token')
    if (token == null) return next()
 
    /*try {
      var user = self.decode_token(token, 60*60)
    } catch(err) {
      return next()
    }
 
    req.remote_user = AuthenticatedUser(user.u, user.g)
    req.remote_user.token = token
    next()*/
    var credentials = self.aes_decrypt(Buffer(token, 'base64')).toString('utf8')
    if (!credentials) return next()
 
    var index = credentials.indexOf(':')
    if (index < 0) return next()
 
    var user = credentials.slice(0, index)
    var pass = credentials.slice(index + 1)
 
    self.authenticate(user, pass, function(err, user) {
      if (!err) {
        req.remote_user = user
        next()
      } else {
        req.remote_user = AnonymousUser()
        next(err)
      }
    })
  }
}
 
Auth.prototype.issue_token = function(user) {
  var data = jju.stringify({
    u: user.name,
    g: user.real_groups && user.real_groups.length ? user.real_groups : undefined,
    t: ~~(Date.now()/1000),
  }, { indent: false })
 
  data = Buffer(data, 'utf8')
  var mac = Crypto.createHmac('sha256', this.secret).update(data).digest()
  return Buffer.concat([ data, mac ]).toString('base64')
}
 
Auth.prototype.decode_token = function(str, expire_time) {
  var buf = Buffer(str, 'base64')
  if (buf.length <= 32) throw Error[401]('invalid token')
 
  var data      = buf.slice(0, buf.length - 32)
  var their_mac = buf.slice(buf.length - 32)
  var good_mac  = Crypto.createHmac('sha256', this.secret).update(data).digest()
 
  their_mac = Crypto.createHash('sha512').update(their_mac).digest('hex')
  good_mac  = Crypto.createHash('sha512').update(good_mac).digest('hex')
  if (their_mac !== good_mac) throw Error[401]('bad signature')
 
  // make token expire in 24 hours
  // TODO: make configurable?
  expire_time = expire_time || 24*60*60
 
  data = jju.parse(data.toString('utf8'))
  if (Math.abs(data.t - ~~(Date.now()/1000)) > expire_time)
    throw Error[401]('token expired')
 
  return data
}
 
Auth.prototype.aes_encrypt = function(buf) {
  var c = Crypto.createCipher('aes192', this.secret)
  var b1 = c.update(buf)
  var b2 = c.final()
  return Buffer.concat([ b1, b2 ])
}
 
Auth.prototype.aes_decrypt = function(buf) {
  try {
    var c = Crypto.createDecipher('aes192', this.secret)
    var b1 = c.update(buf)
    var b2 = c.final()
  } catch(_) {
    return Buffer(0)
  }
  return Buffer.concat([ b1, b2 ])
}
 
function AnonymousUser() {
  return {
    name: undefined,
    // groups without '$' are going to be deprecated eventually
    groups: [ '$all', '$anonymous', '@all', '@anonymous', 'all', 'undefined', 'anonymous' ],
    real_groups: [],
  }
}
 
function AuthenticatedUser(name, groups) {
  var _groups = (groups || []).concat([ '$all', '$authenticated', '@all', '@authenticated', 'all' ])
  return {
    name: name,
    groups: _groups,
    real_groups: groups,
  }
}
 
 
 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
 
 
 
 
1
 
 
 
1
1
 
1
 
 
1
 
 
1
1
 
1
1
1
1
1
1
1
1
1
1
1
1
 
1
 
 
 
 
 
1
 
 
 
 
1
 
 
 
1
1
1
 
 
1
 
1
1
 
 
 
 
 
1
 
1
 
1
 
1
 
1
 
1
 
 
1
 
 
1
1
 
1
 
 
 
 
 
 
1
 
 
 
1
 
 
1
1
1
 
1
 
1
1
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
1
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
1
 
 
 
 
 
 
 
//#!/usr/bin/env node
 
/*eslint no-sync:0*/
 
Iif (process.getuid && process.getuid() === 0) {
  global.console.error("Sinopia doesn't need superuser privileges. Don't run it under root.")
}
 
process.title = 'sinopia'
require('es6-shim')
 
try {
  // for debugging memory leaks
  // totally optional
  require('heapdump')
} catch(err) {}
 
var logger = require('./logger')
logger.setup() // default setup
 
var commander = require('commander')
var constants = require('constants')
var fs        = require('fs')
var http      = require('http')
var https     = require('https')
var YAML      = require('js-yaml')
var Path      = require('path')
var URL       = require('url')
var server    = require('./index')
var Utils     = require('./utils')
var pkg_file  = '../package.yaml'
var pkg       = YAML.safeLoad(fs.readFileSync(__dirname+'/'+ pkg_file, 'utf8'))
 
commander
  .option('-l, --listen <[host:]port>', 'host:port number to listen on (default: localhost:4873)')
  .option('-c, --config <config.yaml>', 'use this configuration file (default: ./config.yaml)')
  .version(pkg.version)
  .parse(process.argv)
 
Iif (commander.args.length == 1 && !commander.config) {
  // handling "sinopia [config]" case if "-c" is missing in commandline
  commander.config = commander.args.pop()
}
 
Iif (commander.args.length != 0) {
  commander.help()
}
 
var config, config_path
try {
  Iif (commander.config) {
    config_path = Path.resolve(commander.config)
  } else {
    config_path = require('./config-path')()
  }
  config = YAML.safeLoad(fs.readFileSync(config_path, 'utf8'))
  logger.logger.warn({ file: config_path }, 'config file  - @{file}')
} catch (err) {
  logger.logger.fatal({ file: config_path, err: err }, 'cannot open config file @{file}: @{!err.message}')
  process.exit(1)
}
 
afterConfigLoad()
 
function get_listen_addresses() {
  // command line || config file || default
  var addresses
 
  Iif (commander.listen) {
    addresses = [ commander.listen ]
  } else Iif (Array.isArray(config.listen)) {
    addresses = config.listen
  } else Iif (config.listen) {
    addresses = [ config.listen ]
  } else {
    addresses = [ '4873' ]
  }
 
  addresses = addresses.map(function(addr) {
    var parsed_addr = Utils.parse_address(addr)
 
    Iif (!parsed_addr) {
      logger.logger.warn({ addr: addr },
         'invalid address - @{addr}, we expect a port (e.g. "4873"),'
       + ' host:port (e.g. "localhost:4873") or full url'
       + ' (e.g. "http://localhost:4873/")')
    }
 
    return parsed_addr
 
  }).filter(Boolean)
 
  return addresses
}
 
function afterConfigLoad() {
  Eif (!config.self_path) config.self_path = Path.resolve(config_path)
  Eif (!config.https) config.https = { enable: false };
 
  var app = server(config)
 
  get_listen_addresses().forEach(function(addr) {
    var webServer
 
    Iif (addr.proto === 'https') { // https
      if (!config.https || !config.https.key || !config.https.cert) {
        var conf_path = function(file) {
          if (!file) return config_path
          return Path.resolve(Path.dirname(config_path), file)
        }
 
        logger.logger.fatal([
          'You need to specify "https.key" and "https.cert" to run https server',
          '',
          // commands are borrowed from node.js docs
          'To quickly create self-signed certificate, use:',
          ' $ openssl genrsa -out ' + conf_path('sinopia-key.pem') + ' 2048',
          ' $ openssl req -new -sha256 -key ' + conf_path('sinopia-key.pem') + ' -out ' + conf_path('sinopia-csr.pem'),
          ' $ openssl x509 -req -in ' + conf_path('sinopia-csr.pem') + ' -signkey ' + conf_path('sinopia-key.pem') + ' -out ' + conf_path('sinopia-cert.pem'),
          '',
          'And then add to config file (' + conf_path() + '):',
          '  https:',
          '    key: sinopia-key.pem',
          '    cert: sinopia-cert.pem',
        ].join('\n'))
        process.exit(2)
      }
 
      try {
        webServer = https.createServer({
          secureProtocol: 'SSLv23_method', // disable insecure SSLv2 and SSLv3
          secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3,
          key: fs.readFileSync(config.https.key),
          cert: fs.readFileSync(config.https.cert)
        }, app)
      } catch (err) { // catch errors related to certificate loading
        logger.logger.fatal({ err: err }, 'cannot create server: @{err.message}')
        process.exit(2)
      }
    } else { // http
      webServer = http.createServer(app);
    }
 
    webServer
      .listen(addr.port || addr.path, addr.host)
      .on('error', function(err) {
        logger.logger.fatal({ err: err }, 'cannot create server: @{err.message}')
        process.exit(2)
      })
 
    logger.logger.warn({
      addr: ( addr.path
            ? URL.format({
                protocol: 'unix',
                pathname: addr.path,
              })
            : URL.format({
                protocol: addr.proto,
                hostname: addr.host,
                port: addr.port,
                pathname: '/',
              })
            ),
      version: 'Sinopia/'+pkg.version,
    }, 'http address - @{addr}')
  })
 
  // undocumented stuff for tests
  Iif (typeof(process.send) === 'function') {
    process.send({ sinopia_started: true })
  }
}
 
process.on('uncaughtException', function(err) {
  logger.logger.fatal( { err: err }
                     , 'uncaught exception, please report this\n@{err.stack}' )
  process.exit(255)
})
 
 
 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
1
1
1
 
1
 
1
1
 
1
1
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
1
1
 
1
1
 
 
 
 
 
1
 
 
 
 
 
 
 
 
1
 
 
 
 
 
1
 
 
 
 
1
 
 
1
1
1
 
 
 
 
1
 
 
1
1
1
 
 
 
 
1
 
 
 
 
var fs     = require('fs')
var Path   = require('path')
var logger = require('./logger')
 
module.exports = find_config_file
 
function find_config_file() {
  var paths = get_paths()
 
  for (var i=0; i<paths.length; i++) {
    Eif (file_exists(paths[i].path)) return paths[i].path
  }
 
  create_config_file(paths[0])
  return paths[0].path
}
 
function create_config_file(config_path) {
  require('mkdirp').sync(Path.dirname(config_path.path))
  logger.logger.info({ file: config_path.path }, 'Creating default config file in @{file}')
 
  var created_config = fs.readFileSync(require.resolve('../conf/default.yaml'), 'utf8')
 
  if (config_path.type === 'xdg') {
    var data_dir = process.env.XDG_DATA_HOME
                || Path.join(process.env.HOME, '.local', 'share')
    if (folder_exists(data_dir)) {
      data_dir = Path.resolve(Path.join(data_dir, 'sinopia', 'storage'))
      created_config = created_config.replace(/^storage: .\/storage$/m, 'storage: ' + data_dir)
    }
  }
 
  fs.writeFileSync(config_path.path, created_config)
}
 
function get_paths() {
  var try_paths = []
  var xdg_config = process.env.XDG_CONFIG_HOME
                || process.env.HOME && Path.join(process.env.HOME, '.config')
  Eif (xdg_config && folder_exists(xdg_config)) {
    try_paths.push({
      path: Path.join(xdg_config, 'sinopia', 'config.yaml'),
      type: 'xdg',
    })
  }
 
  Iif (process.platform === 'win32'
   && process.env.APPDATA
   && folder_exists(process.env.APPDATA)) {
    try_paths.push({
      path: Path.resolve(Path.join(process.env.APPDATA, 'sinopia', 'config.yaml')),
      type: 'win',
    })
  }
 
  try_paths.push({
    path: Path.resolve(Path.join('.', 'sinopia', 'config.yaml')),
    type: 'def',
  })
 
  // backward compatibility
  try_paths.push({
    path: Path.resolve(Path.join('.', 'config.yaml')),
    type: 'old',
  })
 
  return try_paths
}
 
function folder_exists(path) {
  try {
    var stat = fs.statSync(path)
  } catch(_) {
    return false
  }
 
  return stat.isDirectory()
}
 
function file_exists(path) {
  try {
    var stat = fs.statSync(path)
  } catch(_) {
    return false
  }
 
  return stat.isFile()
}
 
 
 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
1
1
1
1
1
1
1
1
1
1
1
 
 
1
14
14
10
5
 
5
 
 
14
 
 
1
1
1
7
 
1
 
 
1
 
1
1
 
 
 
 
 
1
1
 
1
 
 
 
 
 
 
1
 
1
1
1
1
1
 
 
1
3
3
 
 
1
1
 
1
 
 
 
 
 
 
 
1
1
1
 
1
 
 
1
9
 
9
18
 
 
5
5
 
 
 
 
 
 
9
 
 
 
1
1
 
 
1
3
 
 
 
 
3
 
 
 
3
 
3
 
 
 
3
 
3
 
 
 
3
 
 
 
1
3
3
 
 
 
 
1
1
 
 
1
 
1
 
 
1
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
1
 
1
 
 
 
 
 
 
 
 
 
 
 
1
3
 
3
3
3
3
3
3
 
 
 
 
3
3
 
3
 
 
 
 
var assert    = require('assert')
var Crypto    = require('crypto')
var fs        = require('fs')
var YAML      = require('js-yaml')
var Error     = require('http-errors')
var minimatch = require('minimatch')
var Path      = require('path')
var LocalData = require('./local-data')
var Utils     = require('./utils')
var pkg_file  = '../package.yaml'
var pkg       = YAML.safeLoad(fs.readFileSync(__dirname+'/'+pkg_file, 'utf8'))
 
// [[a, [b, c]], d] -> [a, b, c, d]
function flatten(array) {
  var result = []
  for (var i=0; i<array.length; i++) {
    if (Array.isArray(array[i])) {
      result.push.apply(result, flatten(array[i]))
    } else {
      result.push(array[i])
    }
  }
  return result
}
 
function Config(config) {
  var self = Object.create(Config.prototype)
  for (var i in config) {
    Eif (self[i] == null) self[i] = config[i]
  }
  Eif (!self.user_agent) self.user_agent = 'Sinopia/'+pkg.version
 
  // some weird shell scripts are valid yaml files parsed as string
  assert.equal(typeof(config), 'object', 'CONFIG: it doesn\'t look like a valid config file')
 
  assert(self.storage, 'CONFIG: storage path not defined')
  self.localList = LocalData(
    Path.join(
      Path.resolve(Path.dirname(self.self_path), self.storage),
      '.sinopia-db.json'
    )
  )
  Eif (!self.secret) {
    self.secret = self.localList.data.secret
 
    Iif (!self.secret) {
      self.secret = Crypto.pseudoRandomBytes(32).toString('hex')
      self.localList.data.secret = self.secret
      self.localList.sync()
    }
  }
 
  var users = {all:true, anonymous:true, 'undefined':true, owner:true, none:true}
 
  var check_user_or_uplink = function(arg) {
    assert(arg !== 'all' && arg !== 'owner' && arg !== 'anonymous' && arg !== 'undefined' && arg !== 'none', 'CONFIG: reserved user/uplink name: ' + arg)
    assert(!arg.match(/\s/), 'CONFIG: invalid user name: ' + arg)
    assert(users[arg] == null, 'CONFIG: duplicate user/uplink name: ' + arg)
    users[arg] = true
  }
 
  ;[ 'users', 'uplinks', 'packages' ].forEach(function(x) {
    if (self[x] == null) self[x] = {}
    assert(Utils.is_object(self[x]), 'CONFIG: bad "'+x+'" value (object expected)')
  })
 
  for (var i in self.users) check_user_or_uplink(i)
  for (var i in self.uplinks) check_user_or_uplink(i)
 
  for (var i in self.users) {
    assert(self.users[i].password, 'CONFIG: no password for user: ' + i)
    assert(
      typeof(self.users[i].password) === 'string' &&
      self.users[i].password.match(/^[a-f0-9]{40}$/)
    , 'CONFIG: wrong password format for user: ' + i + ', sha1 expected')
  }
 
  for (var i in self.uplinks) {
    assert(self.uplinks[i].url, 'CONFIG: no url for uplink: ' + i)
    assert( typeof(self.uplinks[i].url) === 'string'
          , 'CONFIG: wrong url format for uplink: ' + i)
    self.uplinks[i].url = self.uplinks[i].url.replace(/\/$/, '')
  }
 
  function normalize_userlist() {
    var result = []
 
    for (var i=0; i<arguments.length; i++) {
      if (arguments[i] == null) continue
 
      // if it's a string, split it to array
      Eif (typeof(arguments[i]) === 'string') {
        result.push(arguments[i].split(/\s+/))
      } else if (Array.isArray(arguments[i])) {
        result.push(arguments[i])
      } else {
        throw Error('CONFIG: bad package acl (array or string expected): ' + JSON.stringify(arguments[i]))
      }
    }
    return flatten(result)
  }
 
  // add a default rule for all packages to make writing plugins easier
  Eif (self.packages['**'] == null) {
    self.packages['**'] = {}
  }
 
  for (var i in self.packages) {
    assert(
      typeof(self.packages[i]) === 'object' &&
      !Array.isArray(self.packages[i])
    , 'CONFIG: bad "'+i+'" package description (object expected)')
 
    self.packages[i].access = normalize_userlist(
      self.packages[i].allow_access,
      self.packages[i].access
    );
    delete self.packages[i].allow_access
 
    self.packages[i].publish = normalize_userlist(
      self.packages[i].allow_publish,
      self.packages[i].publish
    );
    delete self.packages[i].allow_publish
 
    self.packages[i].proxy = normalize_userlist(
      self.packages[i].proxy_access,
      self.packages[i].proxy
    );
    delete self.packages[i].proxy_access
  }
 
  // loading these from ENV if aren't in config
  ;[ 'http_proxy', 'https_proxy', 'no_proxy' ].forEach((function(v) {
    Eif (!(v in self)) {
      self[v] = process.env[v] || process.env[v.toUpperCase()]
    }
  }).bind(self))
 
  // unique identifier of self server (or a cluster), used to avoid loops
  Eif (!self.server_id) {
    self.server_id = Crypto.pseudoRandomBytes(6).toString('hex')
  }
 
  Eif (self.ignore_latest_tag == null) self.ignore_latest_tag = false
 
  return self
}
 
Config.prototype.can_proxy_to = function(package, uplink) {
  return (this.get_package_spec(package).proxy || []).reduce(function(prev, curr) {
    if (uplink === curr) return true
    return prev
  }, false)
}
 
Config.prototype.get_package_spec = function(package) {
  for (var i in this.packages) {
    if (minimatch.makeRe(i).exec(package)) {
      return this.packages[i]
    }
  }
  return {}
}
 
module.exports = Config
 
var parse_interval_table = {
  '': 1000,
  ms: 1,
  s: 1000,
  m: 60*1000,
  h: 60*60*1000,
  d: 86400000,
  w: 7*86400000,
  M: 30*86400000,
  y: 365*86400000,
}
 
module.exports.parse_interval = function(interval) {
  Iif (typeof(interval) === 'number') return interval * 1000
 
  var result = 0
  var last_suffix = Infinity
  interval.split(/\s+/).forEach(function(x) {
    Iif (!x) return
    var m = x.match(/^((0|[1-9][0-9]*)(\.[0-9]+)?)(ms|s|m|h|d|w|M|y|)$/)
    Iif (!m
    ||  parse_interval_table[m[4]] >= last_suffix
    ||  (m[4] === '' && last_suffix !== Infinity)) {
      throw Error('invalid interval: ' + interval)
    }
    last_suffix = parse_interval_table[m[4]]
    result += Number(m[1]) * parse_interval_table[m[4]]
  })
  return result
}
 
 
 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
1
1
1
1
1
1
1
1
1
1
1
1
 
1
1
1
 
 
 
1
1
1
1
1
 
 
1
1
1
 
1
 
1
1
 
 
1
 
 
 
 
 
 
1
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
1
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
1
 
 
1
 
 
1
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
1
 
 
 
 
 
1
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
var Cookies       = require('cookies')
var express       = require('express')
var expressJson5  = require('express-json5')
var Error         = require('http-errors')
var Path          = require('path')
var Middleware    = require('./middleware')
var Utils         = require('./utils')
var expect_json   = Middleware.expect_json
var match         = Middleware.match
var media         = Middleware.media
var validate_name = Middleware.validate_name
var validate_pkg  = Middleware.validate_package
 
module.exports = function(config, auth, storage) {
  var app = express.Router()
  var can = Middleware.allow(auth)
 
  // validate all of these params as a package name
  // this might be too harsh, so ask if it causes trouble
  app.param('package',  validate_pkg)
  app.param('filename', validate_name)
  app.param('tag',      validate_name)
  app.param('version',  validate_name)
  app.param('revision', validate_name)
 
  // these can't be safely put into express url for some reason
  app.param('_rev',             match(/^-rev$/))
  app.param('org_couchdb_user', match(/^org\.couchdb\.user:/))
  app.param('anything',         match(/.*/))
 
  app.use(auth.basic_middleware())
  //app.use(auth.bearer_middleware())
  app.use(expressJson5({ strict: false, limit: config.max_body_size || '10mb' }))
  app.use(Middleware.anti_loop(config))
 
  // for "npm whoami"
  app.get('/whoami', function(req, res, next) {
    if (req.headers.referer === 'whoami') {
      next({ username: req.remote_user.name })
    } else {
      next('route')
    }
  })
  app.get('/-/whoami', function(req, res, next) {
    next({ username: req.remote_user.name })
  })
 
  // TODO: anonymous user?
  app.get('/:package/:version?', can('access'), function(req, res, next) {
    storage.get_package(req.params.package, { req: req }, function(err, info) {
      if (err) return next(err)
      info = Utils.filter_tarball_urls(info, req, config)
 
      var version = req.params.version
      if (!version) return next(info)
 
      var t = Utils.get_version(info, version)
      if (t != null) return next(t)
 
      if (info['dist-tags'] != null) {
        if (info['dist-tags'][version] != null) {
          version = info['dist-tags'][version]
          t = Utils.get_version(info, version)
          if (t != null) return next(t)
        }
      }
 
      return next( Error[404]('version not found: ' + req.params.version) )
    })
  })
 
  app.get('/:package/-/:filename', can('access'), function(req, res, next) {
    var stream = storage.get_tarball(req.params.package, req.params.filename)
    stream.on('content-length', function(v) {
      res.header('Content-Length', v)
    })
    stream.on('error', function(err) {
      return res.report_error(err)
    })
    res.header('Content-Type', 'application/octet-stream')
    stream.pipe(res)
  })
 
  // searching packages
  app.get('/-/all/:anything?', function(req, res, next) {
    var received_end      = false
    var response_finished = false
    var processing_pkgs   = 0
 
    res.status(200)
    res.write('{"_updated":' + Date.now());
 
    var stream = storage.search(req.param.startkey || 0, { req: req })
 
    stream.on('data', function each(pkg) {
      processing_pkgs++
 
      auth.allow_access(pkg.name, req.remote_user, function(err, allowed) {
        processing_pkgs--
 
        if (err) {
          if (err.status && String(err.status).match(/^4\d\d$/)) {
            // auth plugin returns 4xx user error,
            // that's equivalent of !allowed basically
            allowed = false
          } else {
            stream.abort(err)
          }
        }
 
        if (allowed) {
          res.write(',\n' + JSON.stringify(pkg.name) + ':' + JSON.stringify(pkg))
        }
 
        check_finish()
      })
    })
 
    stream.on('error', function (_err) {
      res.socket.destroy()
    })
 
    stream.on('end', function () {
      received_end = true
      check_finish()
    })
 
    function check_finish() {
      if (!received_end) return
      if (processing_pkgs) return
      if (response_finished) return
 
      response_finished = true
      res.end('}\n')
    }
  })
 
  // placeholder 'cause npm require to be authenticated to publish
  // we do not do any real authentication yet
  app.post('/_session', Cookies.express(), function(req, res, next) {
    res.cookies.set('AuthSession', String(Math.random()), {
      // npmjs.org sets 10h expire
      expires: new Date(Date.now() + 10*60*60*1000)
    })
    next({ ok: true, name: 'somebody', roles: [] })
  })
 
  app.get('/-/user/:org_couchdb_user', function(req, res, next) {
    res.status(200)
    next({
      ok: 'you are authenticated as "' + req.remote_user.name + '"',
    })
  })
 
  app.put('/-/user/:org_couchdb_user/:_rev?/:revision?', function(req, res, next) {
    var token = (req.body.name && req.body.password)
              ? auth.aes_encrypt(req.body.name + ':' + req.body.password).toString('base64')
              : undefined
    if (req.remote_user.name != null) {
      res.status(201)
      return next({
        ok: "you are authenticated as '" + req.remote_user.name + "'",
        //token: auth.issue_token(req.remote_user),
        token: token,
      })
    } else {
      if (typeof(req.body.name) !== 'string' || typeof(req.body.password) !== 'string') {
        if (typeof(req.body.password_sha)) {
          return next( Error[422]('your npm version is outdated\nPlease update to npm@1.4.5 or greater.\nSee https://github.com/rlidwka/sinopia/issues/93 for details.') )
        } else {
          return next( Error[422]('user/password is not found in request (npm issue?)') )
        }
      }
      auth.add_user(req.body.name, req.body.password, function(err, user) {
        if (err) {
          if (err.status >= 400 && err.status < 500) {
            // With npm registering is the same as logging in,
            // and npm accepts only an 409 error.
            // So, changing status code here.
            return next( Error[409](err.message) )
          }
          return next(err)
        }
 
        req.remote_user = user
        res.status(201)
        return next({
          ok: "user '" + req.body.name + "' created",
          //token: auth.issue_token(req.remote_user),
          token: token,
        })
      })
    }
  })
 
  function tag_package_version(req, res, next) {
    if (typeof(req.body) !== 'string') return next('route')
 
    var tags = {}
    tags[req.params.tag] = req.body
    storage.merge_tags(req.params.package, tags, function(err) {
      if (err) return next(err)
      res.status(201)
      return next({ ok: 'package tagged' })
    })
  }
 
  // tagging a package
  app.put('/:package/:tag',
      can('publish'), media('application/json'), tag_package_version)
 
  app.post('/-/package/:package/dist-tags/:tag',
      can('publish'), media('application/json'), tag_package_version)
 
  app.put('/-/package/:package/dist-tags/:tag',
      can('publish'), media('application/json'), tag_package_version)
 
  app.delete('/-/package/:package/dist-tags/:tag', can('publish'), function (req, res, next) {
    var tags = {}
    tags[req.params.tag] = null
    storage.merge_tags(req.params.package, tags, function(err) {
      if (err) return next(err)
      res.status(201)
      return next({ ok: 'tag removed' })
    })
  })
 
  app.get('/-/package/:package/dist-tags', can('access'), function(req, res, next) {
    storage.get_package(req.params.package, { req: req }, function(err, info) {
      if (err) return next(err)
 
      next(info['dist-tags'])
    })
  })
 
  app.post('/-/package/:package/dist-tags',
      can('publish'), media('application/json'), expect_json,
      function(req, res, next) {
 
    storage.merge_tags(req.params.package, req.body, function(err) {
      if (err) return next(err)
      res.status(201)
      return next({ ok: 'tags updated' })
    })
  })
 
  app.put('/-/package/:package/dist-tags',
      can('publish'), media('application/json'), expect_json,
      function(req, res, next) {
 
    storage.replace_tags(req.params.package, req.body, function(err) {
      if (err) return next(err)
      res.status(201)
      return next({ ok: 'tags updated' })
    })
  })
 
  app.delete('/-/package/:package/dist-tags',
      can('publish'), media('application/json'),
      function(req, res, next) {
 
    storage.replace_tags(req.params.package, {}, function(err) {
      if (err) return next(err)
      res.status(201)
      return next({ ok: 'tags removed' })
    })
  })
 
  // publishing a package
  app.put('/:package/:_rev?/:revision?', can('publish'), media('application/json'), expect_json, function(req, res, next) {
    var name = req.params.package
 
    if (Object.keys(req.body).length == 1 && Utils.is_object(req.body.users)) {
      // 501 status is more meaningful, but npm doesn't show error message for 5xx
      return next( Error[404]('npm star|unstar calls are not implemented') )
    }
 
    try {
      var metadata = Utils.validate_metadata(req.body, name)
    } catch(err) {
      return next( Error[422]('bad incoming package data') )
    }
 
    if (req.params._rev) {
      storage.change_package(name, metadata, req.params.revision, function(err) {
        after_change(err, 'package changed')
      })
    } else {
      storage.add_package(name, metadata, function(err) {
        after_change(err, 'created new package')
      })
    }
 
    function after_change(err, ok_message) {
      // old npm behaviour
      if (metadata._attachments == null) {
        if (err) return next(err)
        res.status(201)
        return next({ ok: ok_message })
      }
 
      // npm-registry-client 0.3+ embeds tarball into the json upload
      // https://github.com/isaacs/npm-registry-client/commit/e9fbeb8b67f249394f735c74ef11fe4720d46ca0
      // issue #31, dealing with it here:
 
      if (typeof(metadata._attachments) !== 'object'
      ||  Object.keys(metadata._attachments).length !== 1
      ||  typeof(metadata.versions) !== 'object'
      ||  Object.keys(metadata.versions).length !== 1) {
 
        // npm is doing something strange again
        // if this happens in normal circumstances, report it as a bug
        return next( Error[400]('unsupported registry call') )
      }
 
      if (err && err.status != 409) return next(err)
 
      // at this point document is either created or existed before
      var t1 = Object.keys(metadata._attachments)[0]
      create_tarball(Path.basename(t1), metadata._attachments[t1], function(err) {
        if (err) return next(err)
 
        var t2 = Object.keys(metadata.versions)[0]
        metadata.versions[t2].readme = metadata.readme != null ? String(metadata.readme) : ''
        create_version(t2, metadata.versions[t2], function(err) {
          if (err) return next(err)
 
          add_tags(metadata['dist-tags'], function(err) {
            if (err) return next(err)
 
            res.status(201)
            return next({ ok: ok_message })
          })
        })
      })
    }
 
    function create_tarball(filename, data, cb) {
      var stream = storage.add_tarball(name, filename)
      stream.on('error', function(err) {
        cb(err)
      })
      stream.on('success', function() {
        cb()
      })
 
      // this is dumb and memory-consuming, but what choices do we have?
      stream.end(Buffer(data.data, 'base64'))
      stream.done()
    }
 
    function create_version(version, data, cb) {
      storage.add_version(name, version, data, null, cb)
    }
 
    function add_tags(tags, cb) {
      storage.merge_tags(name, tags, cb)
    }
  })
 
  // unpublishing an entire package
  app.delete('/:package/-rev/*', can('publish'), function(req, res, next) {
    storage.remove_package(req.params.package, function(err) {
      if (err) return next(err)
      res.status(201)
      return next({ ok: 'package removed' })
    })
  })
 
  // removing a tarball
  app.delete('/:package/-/:filename/-rev/:revision', can('publish'), function(req, res, next) {
    storage.remove_tarball(req.params.package, req.params.filename, req.params.revision, function(err) {
      if (err) return next(err)
      res.status(201)
      return next({ ok: 'tarball removed' })
    })
  })
 
  // uploading package tarball
  app.put('/:package/-/:filename/*', can('publish'), media('application/octet-stream'), function(req, res, next) {
    var name = req.params.package
 
    var stream = storage.add_tarball(name, req.params.filename)
    req.pipe(stream)
 
    // checking if end event came before closing
    var complete = false
    req.on('end', function() {
      complete = true
      stream.done()
    })
    req.on('close', function() {
      if (!complete) {
        stream.abort()
      }
    })
 
    stream.on('error', function(err) {
      return res.report_error(err)
    })
    stream.on('success', function() {
      res.status(201)
      return next({
        ok: 'tarball uploaded successfully'
      })
    })
  })
 
  // adding a version
  app.put('/:package/:version/-tag/:tag', can('publish'), media('application/json'), expect_json, function(req, res, next) {
    var name = req.params.package
    var version = req.params.version
    var tag = req.params.tag
 
    storage.add_version(name, version, req.body, tag, function(err) {
      if (err) return next(err)
      res.status(201)
      return next({ ok: 'package published' })
    })
  })
 
  return app
}
 
 
 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
1
1
1
1
1
1
1
1
1
1
1
1
 
1
1
1
 
 
 
1
1
1
1
 
1
1
1
1
 
 
 
 
 
1
 
1
 
 
 
1
1
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
1
 
 
 
 
var async         = require('async')
var bodyParser    = require('body-parser')
var Cookies       = require('cookies')
var express       = require('express')
var fs            = require('fs')
var Handlebars    = require('handlebars')
var renderReadme  = require('render-readme')
var Search        = require('./search')
var Middleware    = require('./middleware')
var match         = Middleware.match
var validate_name = Middleware.validate_name
var validate_pkg  = Middleware.validate_package
 
module.exports = function(config, auth, storage) {
  var app = express.Router()
  var can = Middleware.allow(auth)
 
  // validate all of these params as a package name
  // this might be too harsh, so ask if it causes trouble
  app.param('package',  validate_pkg)
  app.param('filename', validate_name)
  app.param('version',  validate_name)
  app.param('anything', match(/.*/))
 
  app.use(Cookies.express())
  app.use(bodyParser.urlencoded({ extended: false }))
  app.use(auth.cookie_middleware())
  app.use(function(req, res, next) {
    // disable loading in frames (clickjacking, etc.)
    res.header('X-Frame-Options', 'deny')
    next()
  })
 
  Search.configureStorage(storage)
 
  Iif(config.web && config.web.template) {
    var template = Handlebars.compile(fs.readFileSync(config.web.template, 'utf8'));
  }
  else {
    Handlebars.registerPartial('entry', fs.readFileSync(require.resolve('./GUI/entry.hbs'), 'utf8'))
    var template = Handlebars.compile(fs.readFileSync(require.resolve('./GUI/index.hbs'), 'utf8'))
  }
  app.get('/', function(req, res, next) {
    var base = config.url_prefix
             ? config.url_prefix.replace(/\/$/, '')
             : req.protocol + '://' + req.get('host')
    res.setHeader('Content-Type', 'text/html')
 
    storage.get_local(function(err, packages) {
      if (err) throw err // that function shouldn't produce any
      async.filterSeries(packages, function(package, cb) {
        auth.allow_access(package.name, req.remote_user, function(err, allowed) {
          setImmediate(function () {
            cb(!err && allowed)
          })
        })
      }, function(packages) {
        next(template({
          name:       config.web && config.web.title ? config.web.title : 'Sinopia',
          packages:   packages,
          baseUrl:    base,
          username:   req.remote_user.name,
        }))
      })
    })
  })
 
  // Static
  app.get('/-/static/:filename', function(req, res, next) {
    var file = __dirname + '/static/' + req.params.filename
    res.sendFile(file, function(err) {
      if (!err) return
      if (err.status === 404) {
        next()
      } else {
        next(err)
      }
    })
  })
 
  app.get('/-/logo', function(req, res, next) {
    res.sendFile( config.web && config.web.logo
                ? config.web.logo
                : __dirname + '/static/logo-sm.png' )
  })
 
  app.post('/-/login', function(req, res, next) {
    auth.authenticate(req.body.user, req.body.pass, function(err, user) {
      if (!err) {
        req.remote_user = user
        //res.cookies.set('token', auth.issue_token(req.remote_user))
 
        var str = req.body.user + ':' + req.body.pass
        res.cookies.set('token', auth.aes_encrypt(str).toString('base64'))
      }
 
      var base = config.url_prefix
               ? config.url_prefix.replace(/\/$/, '')
               : req.protocol + '://' + req.get('host')
      res.redirect(base)
    })
  })
 
  app.post('/-/logout', function(req, res, next) {
    var base = config.url_prefix
             ? config.url_prefix.replace(/\/$/, '')
             : req.protocol + '://' + req.get('host')
    res.cookies.set('token', '')
    res.redirect(base)
  })
 
  // Search
  app.get('/-/search/:anything', function(req, res, next) {
    var results = Search.query(req.params.anything)
    var packages = []
 
    var getData = function(i) {
      storage.get_package(results[i].ref, function(err, entry) {
        if (!err && entry) {
          packages.push(entry.versions[entry['dist-tags'].latest])
        }
 
        if (i >= results.length - 1) {
          next(packages)
        } else {
          getData(i + 1)
        }
      })
    }
 
    if (results.length) {
      getData(0)
    } else {
      next([])
    }
  })
 
  app.get('/-/readme/:package/:version?', can('access'), function(req, res, next) {
    storage.get_package(req.params.package, {req: req}, function(err, info) {
      if (err) return next(err)
      next( renderReadme(info.readme || 'ERROR: No README data found!') )
    })
  })
  return app
}
 
 
 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
1
1
1
1
1
1
1
1
1
 
1
1
 
1
1
1
1
 
 
 
1
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
1
1
 
 
 
1
1
 
1
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
1
 
 
 
 
1
 
 
1
 
 
 
1
 
 
 
 
 
 
 
 
 
 
1
 
1
 
 
 
 
var express       = require('express')
var Error         = require('http-errors')
var compression   = require('compression')
var Auth          = require('./auth')
var Logger        = require('./logger')
var Config        = require('./config')
var Middleware    = require('./middleware')
var Cats          = require('./status-cats')
var Storage       = require('./storage')
 
module.exports = function(config_hash) {
  Logger.setup(config_hash.logs)
 
  var config  = Config(config_hash)
  var storage = Storage(config)
  var auth    = Auth(config)
  var app     = express()
 
  // run in production mode by default, just in case
  // it shouldn't make any difference anyway
  app.set('env', process.env.NODE_ENV || 'production')
 
  function error_reporting_middleware(req, res, next) {
    res.report_error = res.report_error || function(err) {
      if (err.status && err.status >= 400 && err.status < 600) {
        if (!res.headersSent) {
          res.status(err.status)
          next({ error: err.message || 'unknown error' })
        }
      } else {
        Logger.logger.error( { err: err }
                           , 'unexpected error: @{!err.message}\n@{err.stack}')
        if (!res.status || !res.send) {
          Logger.logger.error('this is an error in express.js, please report this')
          res.destroy()
        } else if (!res.headersSent) {
          res.status(500)
          next({ error: 'internal server error' })
        } else {
          // socket should be already closed
        }
      }
    }
    next()
  }
 
  app.use(Middleware.log)
  app.use(error_reporting_middleware)
  app.use(function(req, res, next) {
    res.setHeader('X-Powered-By', config.user_agent)
    next()
  })
  app.use(Cats.middleware)
  app.use(compression())
 
  app.get('/favicon.ico', function(req, res, next) {
    req.url = '/-/static/favicon.png'
    next()
  })
 
  // hook for tests only
  Iif (config._debug) {
    app.get('/-/_debug', function(req, res, next) {
      var do_gc = typeof(global.gc) !== 'undefined'
      if (do_gc) global.gc()
      next({
        pid  : process.pid,
        main : process.mainModule.filename,
        conf : config.self_path,
        mem  : process.memoryUsage(),
        gc   : do_gc,
      })
    })
  }
 
  app.use(require('./index-api')(config, auth, storage))
 
  Iif (config.web && config.web.enable === false) {
    app.get('/', function(req, res, next) {
      next( Error[404]('web interface is disabled in the config file') )
    })
  } else {
    app.use(require('./index-web')(config, auth, storage))
  }
 
  app.get('/*', function(req, res, next) {
    next( Error[404]('file not found') )
  })
 
  app.use(function(err, req, res, next) {
    if (Object.prototype.toString.call(err) !== '[object Error]') return next(err)
    if (err.code === 'ECONNABORT' && res.statusCode === 304) return next()
    if (typeof(res.report_error) !== 'function') {
      // in case of very early error this middleware may not be loaded before error is generated
      // fixing that
      error_reporting_middleware(req, res, function(){})
    }
    res.report_error(err)
  })
 
  app.use(Middleware.final)
 
  return app
}
 
 
 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
1
1
 
1
 
1
1
1
1
1
 
 
 
1
 
 
1
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
1
1
 
 
1
 
 
 
 
 
 
 
 
 
var fs   = require('fs')
var Path = require('path')
 
module.exports = LocalData
 
function LocalData(path) {
  var self = Object.create(LocalData.prototype)
  self.path = path
  try {
    self.data = JSON.parse(fs.readFileSync(self.path, 'utf8'))
  } catch(_) {
    self.data = { list: [] }
  }
  return self
}
 
LocalData.prototype.add = function(name) {
  if (this.data.list.indexOf(name) === -1) {
    this.data.list.push(name)
    this.sync()
  }
}
 
LocalData.prototype.remove = function(name) {
  var i = this.data.list.indexOf(name)
  if (i !== -1) {
    this.data.list.splice(i, 1)
  }
 
  this.sync()
}
 
LocalData.prototype.get = function() {
  return this.data.list
}
 
LocalData.prototype.sync = function() {
  // Uses sync to prevent ugly race condition
  try {
    require('mkdirp').sync(Path.dirname(this.path))
  } catch(err) {}
  fs.writeFileSync(this.path, JSON.stringify(this.data))
}
 
 
 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
1
1
1
1
1
 
1
 
 
 
 
 
1
1
 
1
 
 
 
 
 
 
1
 
 
 
1
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
1
 
 
 
 
 
 
1
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
1
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
1
 
 
 
1
 
1
 
 
 
1
 
1
 
 
 
1
 
1
 
1
 
1
 
 
 
var fs        = require('fs')
var Error     = require('http-errors')
var mkdirp    = require('mkdirp')
var Path      = require('path')
var MyStreams = require('./streams')
 
function FSError(code) {
  var err = Error(code)
  err.code = code
  return err
}
 
try {
  var fsExt = require('fs-ext')
} catch (e) {
  fsExt = {
    flock: function() {
      arguments[arguments.length-1]()
    }
  }
}
 
function tempFile(str) {
  return str + '.tmp' + String(Math.random()).substr(2)
}
 
function renameTmp(src, dst, _cb) {
  function cb(err) {
    if (err) fs.unlink(src)
    _cb(err)
  }
 
  if (process.platform !== 'win32') {
    return fs.rename(src, dst, cb)
  }
 
  // windows can't remove opened file,
  // but it seem to be able to rename it
  var tmp = tempFile(dst)
  fs.rename(dst, tmp, function(err) {
    fs.rename(src, dst, cb)
    if (!err) fs.unlink(tmp)
  })
}
 
function write(dest, data, cb) {
  var safe_write = function(cb) {
    var tmpname = tempFile(dest)
    fs.writeFile(tmpname, data, function(err) {
      if (err) return cb(err)
      renameTmp(tmpname, dest, cb)
    })
  }
 
  safe_write(function(err) {
    if (err && err.code === 'ENOENT') {
      mkdirp(Path.dirname(dest), function(err) {
        if (err) return cb(err)
        safe_write(cb)
      })
    } else {
      cb(err)
    }
  })
}
 
function write_stream(name) {
  var stream = MyStreams.UploadTarballStream()
 
  var _ended = 0
  stream.on('end', function() {
    _ended = 1
  })
 
  fs.exists(name, function(exists) {
    if (exists) return stream.emit('error', FSError('EEXISTS'))
 
    var tmpname = name + '.tmp-'+String(Math.random()).replace(/^0\./, '')
    var file = fs.createWriteStream(tmpname)
    var opened = false
    stream.pipe(file)
 
    stream.done = function() {
      function onend() {
        file.on('close', function() {
          renameTmp(tmpname, name, function(err) {
            if (err) {
              stream.emit('error', err)
            } else {
              stream.emit('success')
            }
          })
        })
        file.destroySoon()
      }
      if (_ended) {
        onend()
      } else {
        stream.on('end', onend)
      }
    }
    stream.abort = function() {
      if (opened) {
        opened = false
        file.on('close', function() {
          fs.unlink(tmpname, function(){})
        })
      }
      file.destroySoon()
    }
    file.on('open', function() {
      opened = true
      // re-emitting open because it's handled in storage.js
      stream.emit('open')
    })
    file.on('error', function(err) {
      stream.emit('error', err)
    })
  })
  return stream
}
 
function read_stream(name, stream, callback) {
  var rstream = fs.createReadStream(name)
  rstream.on('error', function(err) {
    stream.emit('error', err)
  })
  rstream.on('open', function(fd) {
    fs.fstat(fd, function(err, stats) {
      if (err) return stream.emit('error', err)
      stream.emit('content-length', stats.size)
      stream.emit('open')
      rstream.pipe(stream)
    })
  })
 
  var stream = MyStreams.ReadTarballStream()
  stream.abort = function() {
    rstream.close()
  }
  return stream
}
 
function create(name, contents, callback) {
  fs.exists(name, function(exists) {
    if (exists) return callback( FSError('EEXISTS') )
    write(name, contents, callback)
  })
}
 
function update(name, contents, callback) {
  fs.exists(name, function(exists) {
    if (!exists) return callback( FSError('ENOENT') )
    write(name, contents, callback)
  })
}
 
function read(name, callback) {
  fs.readFile(name, callback)
}
 
// open and flock with exponential backoff
function open_flock(name, opmod, flmod, tries, backoff, cb) {
  fs.open(name, opmod, function(err, fd) {
    if (err) return cb(err, fd)
 
    fsExt.flock(fd, flmod, function(err) {
      if (err) {
        if (!tries) {
          fs.close(fd, function() {
            cb(err)
          })
        } else {
          fs.close(fd, function() {
            setTimeout(function() {
              open_flock(name, opmod, flmod, tries-1, backoff*2, cb)
            }, backoff)
          })
        }
      } else {
        cb(null, fd)
      }
    })
  })
}
 
// this function neither unlocks file nor closes it
// it'll have to be done manually later
function lock_and_read(name, _callback) {
  open_flock(name, 'r', 'exnb', 4, 10, function(err, fd) {
    function callback(err) {
      if (err && fd) {
        fs.close(fd, function(err2) {
          _callback(err)
        })
      } else {
        _callback.apply(null, arguments)
      }
    }
 
    if (err) return callback(err, fd)
 
    fs.fstat(fd, function(err, st) {
      if (err) return callback(err, fd)
 
      var buffer = Buffer(st.size)
      if (st.size === 0) return onRead(null, 0, buffer)
      fs.read(fd, buffer, 0, st.size, null, onRead)
 
      function onRead(err, bytesRead, buffer) {
        if (err) return callback(err, fd)
        if (bytesRead != st.size) return callback(Error('st.size != bytesRead'), fd)
 
        callback(null, fd, buffer)
      }
    })
  })
}
 
module.exports.read = read
 
module.exports.read_json = function(name, cb) {
  read(name, function(err, res) {
    if (err) return cb(err)
 
    var args = []
    try {
      args = [ null, JSON.parse(res.toString('utf8')) ]
    } catch(err) {
      args = [ err ]
    }
    cb.apply(null, args)
  })
}
 
module.exports.lock_and_read = lock_and_read
 
module.exports.lock_and_read_json = function(name, cb) {
  lock_and_read(name, function(err, fd, res) {
    if (err) return cb(err, fd)
 
    var args = []
    try {
      args = [ null, fd, JSON.parse(res.toString('utf8')) ]
    } catch(err) {
      args = [ err, fd ]
    }
    cb.apply(null, args)
  })
}
 
module.exports.create = create
 
module.exports.create_json = function(name, value, cb) {
  create(name, JSON.stringify(value, null, '\t'), cb)
}
 
module.exports.update = update
 
module.exports.update_json = function(name, value, cb) {
  update(name, JSON.stringify(value, null, '\t'), cb)
}
 
module.exports.write = write
 
module.exports.write_json = function(name, value, cb) {
  write(name, JSON.stringify(value, null, '\t'), cb)
}
 
module.exports.write_stream = write_stream
 
module.exports.read_stream = read_stream
 
module.exports.unlink = fs.unlink
 
module.exports.rmdir = fs.rmdir
 
 
 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
1
1
1
1
1
1
1
1
1
1
1
1
1
1
 
 
 
 
 
1
1
1
1
1
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
1
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
 
1
 
 
 
 
 
1
14
14
 
 
 
1
14
 
 
 
 
 
 
1
 
 
1
 
 
 
var assert     = require('assert')
var async      = require('async')
var Crypto     = require('crypto')
var fs         = require('fs')
var Error      = require('http-errors')
var Path       = require('path')
var Stream     = require('readable-stream')
var URL        = require('url')
var fs_storage = require('./local-fs')
var Logger     = require('./logger')
var Search     = require('./search')
var MyStreams  = require('./streams')
var Utils      = require('./utils')
var info_file  = 'package.json'
 
//
// Implements Storage interface
// (same for storage.js, local-storage.js, up-storage.js)
//
function Storage(config) {
  var self = Object.create(Storage.prototype)
  self.config = config
  self.logger = Logger.logger.child({ sub: 'fs' })
  return self
}
 
// returns the minimal package file
function get_boilerplate(name) {
  return {
    // standard things
    name: name,
    versions: {},
    'dist-tags': {},
 
    // our own object
    '_distfiles': {},
    '_attachments': {},
    '_uplinks': {},
  }
}
 
Storage.prototype._internal_error = function(err, file, message) {
  this.logger.error( { err: err, file: file }
                   , message + ' @{file}: @{!err.message}' )
  return Error[500]()
}
 
Storage.prototype.add_package = function(name, info, callback) {
  var storage = this.storage(name)
  if (!storage) return callback( Error[404]('this package cannot be added') )
 
  storage.create_json(info_file, get_boilerplate(name), function(err) {
    if (err && err.code === 'EEXISTS') {
      return callback( Error[409]('this package is already present') )
    }
 
    var latest = info['dist-tags'].latest
    if (latest && info.versions[latest]) {
      Search.add(info.versions[latest])
    }
    callback()
  })
}
 
Storage.prototype.remove_package = function(name, callback) {
  var self = this
  self.logger.info( { name: name }
                  , 'unpublishing @{name} (all)')
 
  var storage = self.storage(name)
  if (!storage) return callback( Error[404]('no such package available') )
 
  storage.read_json(info_file, function(err, data) {
    if (err) {
      if (err.code === 'ENOENT') {
        return callback( Error[404]('no such package available') )
      } else {
        return callback(err)
      }
    }
    self._normalize_package(data)
 
    storage.unlink(info_file, function(err) {
      if (err) return callback(err)
 
      var files = Object.keys(data._attachments)
 
      function unlinkNext(cb) {
        if (files.length === 0) return cb()
 
        var file = files.shift()
        storage.unlink(file, function() {
          unlinkNext(cb)
        })
      }
 
      unlinkNext(function() {
        // try to unlink the directory, but ignore errors because it can fail
        storage.rmdir('.', function(err) {
          callback(err)
        })
      })
    })
  })
 
  Search.remove(name)
  this.config.localList.remove(name)
}
 
Storage.prototype._read_create_package = function(name, callback) {
  var self = this
  var storage = self.storage(name)
  if (!storage) {
    var data = get_boilerplate(name)
    self._normalize_package(data)
    return callback(null, data)
  }
  storage.read_json(info_file, function(err, data) {
    // TODO: race condition
    if (err) {
      if (err.code === 'ENOENT') {
        // if package doesn't exist, we create it here
        data = get_boilerplate(name)
      } else {
        return callback(self._internal_error(err, info_file, 'error reading'))
      }
    }
    self._normalize_package(data)
    callback(null, data)
  })
}
 
// synchronize remote package info with the local one
// TODO: readfile called twice
Storage.prototype.update_versions = function(name, newdata, callback) {
  var self = this
  self._read_create_package(name, function(err, data) {
    if (err) return callback(err)
 
    var change = false
    for (var ver in newdata.versions) {
      if (data.versions[ver] == null) {
        var verdata = newdata.versions[ver]
 
        // we don't keep readmes for package versions,
        // only one readme per package
        delete verdata.readme
 
        change = true
        data.versions[ver] = verdata
 
        if (verdata.dist && verdata.dist.tarball) {
          var filename = URL.parse(verdata.dist.tarball).pathname.replace(/^.*\//, '')
          // we do NOT overwrite any existing records
          if (data._distfiles[filename] == null) {
            var hash = data._distfiles[filename] = {
              url: verdata.dist.tarball,
              sha: verdata.dist.shasum,
            }
 
            if (verdata._sinopia_uplink) {
              // if we got this information from a known registry,
              // use the same protocol for the tarball
              //
              // see https://github.com/rlidwka/sinopia/issues/166
              var tarball_url = URL.parse(hash.url)
              var uplink_url  = URL.parse(self.config.uplinks[verdata._sinopia_uplink].url)
              if (uplink_url.host === tarball_url.host) {
                tarball_url.protocol = uplink_url.protocol
                hash.registry = verdata._sinopia_uplink
                hash.url = URL.format(tarball_url)
              }
            }
          }
        }
      }
    }
    for (var tag in newdata['dist-tags']) {
      if (!Array.isArray(data['dist-tags'][tag]) || data['dist-tags'][tag].length != newdata['dist-tags'][tag].length) {
        // backward compat
        var need_change = true
      } else {
        for (var i=0; i<data['dist-tags'][tag].length; i++) {
          if (data['dist-tags'][tag][i] != newdata['dist-tags'][tag][i]) {
            var need_change = true
            break
          }
        }
      }
 
      if (need_change) {
        change = true
        data['dist-tags'][tag] = newdata['dist-tags'][tag]
      }
    }
    for (var up in newdata._uplinks) {
      var need_change = !Utils.is_object(data._uplinks[up])
                     || newdata._uplinks[up].etag !== data._uplinks[up].etag
                     || newdata._uplinks[up].fetched !== data._uplinks[up].fetched
 
      if (need_change) {
        change = true
        data._uplinks[up] = newdata._uplinks[up]
      }
    }
    if (newdata.readme !== data.readme) {
      data.readme = newdata.readme
      change = true
    }
 
    if (change) {
      self.logger.debug('updating package info')
      self._write_package(name, data, function(err) {
        callback(err, data)
      })
    } else {
      callback(null, data)
    }
  })
}
 
Storage.prototype.add_version = function(name, version, metadata, tag, callback) {
  var self = this
  self.update_package(name, function updater(data, cb) {
    // keep only one readme per package
    data.readme = metadata.readme
    delete metadata.readme
 
    if (data.versions[version] != null) {
      return cb( Error[409]('this version already present') )
    }
 
    // if uploaded tarball has a different shasum, it's very likely that we have some kind of error
    if (Utils.is_object(metadata.dist) && typeof(metadata.dist.tarball) === 'string') {
      var tarball = metadata.dist.tarball.replace(/.*\//, '')
      if (Utils.is_object(data._attachments[tarball])) {
        if (data._attachments[tarball].shasum != null && metadata.dist.shasum != null) {
          if (data._attachments[tarball].shasum != metadata.dist.shasum) {
            return cb( Error[400]('shasum error, '
                                + data._attachments[tarball].shasum
                                + ' != ' + metadata.dist.shasum) )
          }
        }
 
        data._attachments[tarball].version = version
      }
    }
 
    data.versions[version] = metadata
    Utils.tag_version(data, version, tag, self.config)
    self.config.localList.add(name)
    cb()
  }, callback)
}
 
Storage.prototype.merge_tags = function(name, tags, callback) {
  var self = this
 
  self.update_package(name, function updater(data, cb) {
    for (var t in tags) {
      if (tags[t] === null) {
        delete data['dist-tags'][t]
        continue
      }
 
      if (data.versions[tags[t]] == null) {
        return cb( Error[404]("this version doesn't exist") )
      }
 
      Utils.tag_version(data, tags[t], t, self.config)
    }
    cb()
  }, callback)
}
 
Storage.prototype.replace_tags = function(name, tags, callback) {
  var self = this
 
  self.update_package(name, function updater(data, cb) {
    data['dist-tags'] = {}
 
    for (var t in tags) {
      if (tags[t] === null) {
        delete data['dist-tags'][t]
        continue
      }
 
      if (data.versions[tags[t]] == null) {
        return cb( Error[404]("this version doesn't exist") )
      }
 
      Utils.tag_version(data, tags[t], t, self.config)
    }
    cb()
  }, callback)
}
 
// currently supports unpublishing only
Storage.prototype.change_package = function(name, metadata, revision, callback) {
  var self = this
 
  if (!Utils.is_object(metadata.versions) || !Utils.is_object(metadata['dist-tags'])) {
    return callback( Error[422]('bad data') )
  }
 
  self.update_package(name, function updater(data, cb) {
    for (var ver in data.versions) {
      if (metadata.versions[ver] == null) {
        self.logger.info( { name: name, version: ver }
                        , 'unpublishing @{name}@@{version}')
        delete data.versions[ver]
 
        for (var file in data._attachments) {
          if (data._attachments[file].version === ver) {
            delete data._attachments[file].version
          }
        }
      }
    }
    data['dist-tags'] = metadata['dist-tags']
    cb()
  }, function(err) {
    if (err) return callback(err)
    callback()
  })
}
 
Storage.prototype.remove_tarball = function(name, filename, revision, callback) {
  assert(Utils.validate_name(filename))
  var self = this
 
  self.update_package(name, function updater(data, cb) {
    if (data._attachments[filename]) {
      delete data._attachments[filename]
      cb()
    } else {
      cb(Error[404]('no such file available'))
    }
  }, function(err) {
    if (err) return callback(err)
    var storage = self.storage(name)
    if (storage) storage.unlink(filename, callback)
  })
}
 
Storage.prototype.add_tarball = function(name, filename) {
  assert(Utils.validate_name(filename))
 
  var stream = MyStreams.UploadTarballStream()
  var _transform = stream._transform
  var length = 0
  var shasum = Crypto.createHash('sha1')
 
  stream.abort = stream.done = function(){}
 
  stream._transform = function(data) {
    shasum.update(data)
    length += data.length
    _transform.apply(stream, arguments)
  }
 
  var self = this
  if (name === info_file || name === '__proto__') {
    process.nextTick(function() {
      stream.emit('error', Error[403]("can't use this filename"))
    })
    return stream
  }
 
  var storage = self.storage(name)
  if (!storage) {
    process.nextTick(function() {
      stream.emit('error', Error[404]("can't upload this package"))
    })
    return stream
  }
 
  var wstream = storage.write_stream(filename)
 
  wstream.on('error', function(err) {
    if (err.code === 'EEXISTS') {
      stream.emit('error', Error[409]('this tarball is already present'))
    } else if (err.code === 'ENOENT') {
      // check if package exists to throw an appropriate message
      self.get_package(name, function(_err, res) {
        if (_err) {
          stream.emit('error', _err)
        } else {
          stream.emit('error', err)
        }
      })
    } else {
      stream.emit('error', err)
    }
  })
 
  wstream.on('open', function() {
    // re-emitting open because it's handled in storage.js
    stream.emit('open')
  })
  wstream.on('success', function() {
    self.update_package(name, function updater(data, cb) {
      data._attachments[filename] = {
        shasum: shasum.digest('hex'),
      }
      cb()
    }, function(err) {
      if (err) {
        stream.emit('error', err)
      } else {
        stream.emit('success')
      }
    })
  })
  stream.abort = function() {
    wstream.abort()
  }
  stream.done = function() {
    if (!length) {
      stream.emit('error', Error[422]('refusing to accept zero-length file'))
      wstream.abort()
    } else {
      wstream.done()
    }
  }
  stream.pipe(wstream)
 
  return stream
}
 
Storage.prototype.get_tarball = function(name, filename, callback) {
  assert(Utils.validate_name(filename))
  var self = this
 
  var stream = MyStreams.ReadTarballStream()
  stream.abort = function() {
    if (rstream) rstream.abort()
  }
 
  var storage = self.storage(name)
  if (!storage) {
    process.nextTick(function() {
      stream.emit('error', Error[404]('no such file available'))
    })
    return stream
  }
 
  var rstream = storage.read_stream(filename)
  rstream.on('error', function(err) {
    if (err && err.code === 'ENOENT') {
      stream.emit('error', Error(404, 'no such file available'))
    } else {
      stream.emit('error', err)
    }
  })
  rstream.on('content-length', function(v) {
    stream.emit('content-length', v)
  })
  rstream.on('open', function() {
    // re-emitting open because it's handled in storage.js
    stream.emit('open')
    rstream.pipe(stream)
  })
  return stream
}
 
Storage.prototype.get_package = function(name, options, callback) {
  if (typeof(options) === 'function') callback = options, options = {}
 
  var self = this
  var storage = self.storage(name)
  if (!storage) return callback( Error[404]('no such package available') )
 
  storage.read_json(info_file, function(err, result) {
    if (err) {
      if (err.code === 'ENOENT') {
        return callback( Error[404]('no such package available') )
      } else {
        return callback(self._internal_error(err, info_file, 'error reading'))
      }
    }
    self._normalize_package(result)
    callback(err, result)
  })
}
 
// walks through each package and calls `on_package` on them
Storage.prototype._each_package = function (on_package, on_end) {
  var self = this
  var storages = {}
 
  storages[self.config.storage] = true
 
  if (self.config.packages) {
    Object.keys(self.packages || {}).map(function (pkg) {
      if (self.config.packages[pkg].storage) {
        storages[self.config.packages[pkg].storage] = true
      }
    })
  }
 
  var base = Path.dirname(self.config.self_path);
 
  async.eachSeries(Object.keys(storages), function (storage, cb) {
    fs.readdir(Path.resolve(base, storage), function (err, files) {
      if (err) return cb(err)
 
      async.eachSeries(files, function (file, cb) {
        if (file.match(/^@/)) {
          // scoped
          fs.readdir(Path.resolve(base, storage, file), function (err, files) {
            if (err) return cb(err)
 
            async.eachSeries(files, function (file2, cb) {
              if (Utils.validate_name(file2)) {
                on_package({
                  name: file + '/' + file2,
                  path: Path.resolve(base, storage, file, file2),
                }, cb)
              } else {
                cb()
              }
            }, cb)
          })
        } else if (Utils.validate_name(file)) {
          on_package({
            name: file,
            path: Path.resolve(base, storage, file)
          }, cb)
        } else {
          cb()
        }
      }, cb)
    })
  }, on_end)
}
 
//
// This function allows to update the package thread-safely
//
// Arguments:
// - name - package name
// - updateFn - function(package, cb) - update function
// - callback - callback that gets invoked after it's all updated
//
// Algorithm:
// 1. lock package.json for writing
// 2. read package.json
// 3. updateFn(pkg, cb), and wait for cb
// 4. write package.json.tmp
// 5. move package.json.tmp package.json
// 6. callback(err?)
//
Storage.prototype.update_package = function(name, updateFn, _callback) {
  var self = this
  var storage = self.storage(name)
  if (!storage) return _callback( Error[404]('no such package available') )
  storage.lock_and_read_json(info_file, function(err, fd, json) {
    function callback() {
      var _args = arguments
      if (fd) {
        fs.close(fd, function(err) {
          if (err) return _callback(err)
          _callback.apply(null, _args)
        })
      } else {
        _callback.apply(null, _args)
      }
    }
 
    if (err) {
      if (err.code === 'EAGAIN') {
        return callback( Error[503]('resource temporarily unavailable') )
      } else if (err.code === 'ENOENT') {
        return callback( Error[404]('no such package available') )
      } else {
        return callback(err)
      }
    }
 
    self._normalize_package(json)
    updateFn(json, function(err) {
      if (err) return callback(err)
 
      self._write_package(name, json, callback)
    })
  })
}
 
Storage.prototype.search = function(startkey, options) {
  var self = this
 
  var stream = new Stream.PassThrough({ objectMode: true })
 
  self._each_package(function on_package(item, cb) {
    fs.stat(item.path, function(err, stats) {
      if (err) return cb(err)
 
      if (stats.mtime > startkey) {
        self.get_package(item.name, options, function(err, data) {
          if (err) return cb(err)
 
          var versions = Utils.semver_sort(Object.keys(data.versions))
          var latest = versions[versions.length - 1]
 
          if (data.versions[latest]) {
            stream.push({
              name           : data.versions[latest].name,
              description    : data.versions[latest].description,
              'dist-tags'    : { latest: latest },
              maintainers    : data.versions[latest].maintainers ||
                                 [ data.versions[latest]._npmUser ].filter(Boolean),
              author         : data.versions[latest].author,
              repository     : data.versions[latest].repository,
              readmeFilename : data.versions[latest].readmeFilename || '',
              homepage       : data.versions[latest].homepage,
              keywords       : data.versions[latest].keywords,
              bugs           : data.versions[latest].bugs,
              license        : data.versions[latest].license,
              time           : { modified: item.time ? new Date(item.time).toISOString() : undefined },
              versions       : {},
            })
          }
 
          cb()
        })
      } else {
        cb()
      }
    })
  }, function on_end(err) {
    if (err) return stream.emit('error', err)
    stream.end()
  })
 
  return stream
}
 
Storage.prototype._normalize_package = function(pkg) {
  ;['versions', 'dist-tags', '_distfiles', '_attachments', '_uplinks'].forEach(function(key) {
    if (!Utils.is_object(pkg[key])) pkg[key] = {}
  })
  if (typeof(pkg._rev) !== 'string') pkg._rev = '0-0000000000000000'
}
 
Storage.prototype._write_package = function(name, json, callback) {
 
  // calculate revision a la couchdb
  if (typeof(json._rev) !== 'string') json._rev = '0-0000000000000000'
  var rev = json._rev.split('-')
  json._rev = ((+rev[0] || 0) + 1) + '-' + Crypto.pseudoRandomBytes(8).toString('hex')
 
  var storage = this.storage(name)
  if (!storage) return callback()
  storage.write_json(info_file, json, callback)
}
 
Storage.prototype.storage = function(package) {
  var path = this.config.get_package_spec(package).storage
  if (path == null) path = this.config.storage
  if (path == null || path === false) {
    this.logger.debug( { name: package }
                     , 'this package has no storage defined: @{name}' )
    return null
  }
  return Path_Wrapper(
    Path.join(
      Path.resolve(Path.dirname(this.config.self_path), path),
      package
    )
  )
}
 
var Path_Wrapper = (function() {
  // a wrapper adding paths to fs_storage methods
  function Wrapper(path) {
    var self = Object.create(Wrapper.prototype)
    self.path = path
    return self
  }
 
  for (var i in fs_storage) {
    Eif (fs_storage.hasOwnProperty(i)) {
      Wrapper.prototype[i] = wrapper(i)
    }
  }
 
  function wrapper(method) {
    return function(/*...*/) {
      var args = Array.prototype.slice.apply(arguments)
      args[0] = Path.join(this.path, args[0] || '')
      return fs_storage[method].apply(null, args)
    }
  }
 
  return Wrapper
})()
 
module.exports = Storage